There are many different flavors of poisoning attacks. In this paper, we focus on two attacks from both sides of the spectrum: A simple and robust backdoor trigger attack and a modern poisoning attack that is targeted and also clean-label. Backdoor trigger attacks insert a specific trigger pattern (usually a small patch, but sometimes an additive perturbation or non-rectangular symbol) into training data. If this pattern is then added to images at test time, the network will misclassify the test image, assigning the label that was placed on the training images poisoned at train time. In contrast, targeted attacks are those in which the attacker wishes to modify the victim model to specifically misclassify a set of target images at inference time. Such attacks are often clean-label, meaning the modified training images retain their semantic content and are labeled correctly. Such attacks are optimization-based, finding the most effective perturbation of training data using gradient descent. This can make the attack especially hard to detect for sanitization-based defenses because it does not significantly degrade clean accuracy [1]}, [2]}. We focus on both backdoor and clean-label attacks because of their renewed and recent interest in the community and because they cover the poisoning literature from two sides.
